Evidence By-Product

The evidence an auditor wants already exists — in pipeline logs, approval records, deployment history, access grants. It is scattered, inconsistently formatted, missing the attributes required, and frequently outside its retention window.

So every audit cycle becomes an archaeology project consuming weeks of engineering time, repeated forever.

The shift

A control that records what it checked, when, on which artefact, with what result, and under whose authority is producing audit evidence as a side effect of doing its job. Nothing is assembled afterwards because nothing needs to be.

This is why automated controls and audit cost are related: the same investment that makes the control operate consistently makes the evidence exist by default.

Implementation patterns

• Structured records at the point of control execution, with the attributes an auditor needs designed in rather than inferred later.
• Retention matched to the audit period, since evidence deleted before the audit is equivalent to a control that did not operate.
• Immutable and attributable records, because evidence that could have been altered is weak evidence — the auditor's question is not only what happened but whether the record can be trusted.
• Linkage across systems, so a deployment traces to its approval, its tests, its change record and its artefact provenance. The links are what auditors actually test, and reconstructing them manually is where most of the preparation effort goes.
• A standing queryable view rather than a per-audit extract, so the control environment's state can be examined at any time.
• The population, not a sample, including failures and what happened to them.

Industry example

Engineering organisations that instrument their pipelines find audits become a review of an existing record rather than an investigation, and the preparation cost falls by an order of magnitude. Those that do not pay the cost every cycle, and it grows with the estate.

One counterintuitive finding recurs: exceptions handled visibly are stronger evidence than an unblemished record. A control log showing failures, escalations and resolutions demonstrates that the control operates and that deviations are managed. A perfect record invites the question of what was not captured.

Failure scenarios

• Evidence assembled per audit, which is the cost being described.
• Retention shorter than the audit period, silently invalidating the control's evidence.
• Mutable records, which are weak evidence regardless of accuracy.
• Unlinked records, so the chain an auditor tests cannot be demonstrated.
• Only successes recorded, which is both incomplete and less credible.

Trade-offs

Instrumenting controls to produce structured, linked, retained evidence is upfront engineering that delivers no functional value, and it competes with product work. The retention itself carries storage cost and, where the records contain personal data, its own governance obligations.

The argument that gets it funded is that the cost of audit is a function of how the systems were built — so this is a compounding investment rather than a compliance expense, and it is one of the few places where a control investment reduces ongoing cost rather than adding to it.

Interview question

"Your last audit cost six engineer-weeks of preparation. Where did that time actually go, and what would you build so that next year it goes to zero?"